Snapshot and restore macOS preference domains

Adds a round-trip mechanism for macOS system preferences that are not
covered by Homebrew or Mackup (Dock layout, Finder options, global
keyboard shortcuts, input sources, Spaces config, menu-bar clock,
NSGlobalDomain).

sync: `ssr sync` exports each configured domain with `defaults export`
and writes one plist per domain to <backup_dir>/macos-prefs/.  Export is
soft-fail per domain so one bad domain doesn't abort the sync. Gated by
SSR_SNAPSHOT_MACOS_PREFS=true (default on).

restore: `ssr restore` replays the snapshot with `defaults import` after
the declarative config/macos-defaults.sh runs, so the snapshot is the
last writer and wins for accepted domains.  Before importing, the restore
detects domains that both the snapshot and macos-defaults.sh touch and
prompts interactively:

  Domain `com.apple.dock`:
    Snapshot will OVERRIDE values set by macos-defaults.sh.
    [A]ccept snapshot / [r]eject (keep declarative)? [A/r]:

Non-TTY (launchd, CI) falls back to SSR_PREFS_CONFLICT_DEFAULT (default
"accept"). SSR_ASSUME_YES=true skips all prompts. After import, Dock,
Finder, SystemUIServer and cfprefsd are restarted once.

New config keys: SSR_SNAPSHOT_MACOS_PREFS, SSR_MACOS_PREF_DOMAINS,
SSR_MACOS_PREF_DOMAINS_EXTRA, SSR_PREFS_CONFLICT_DEFAULT, SSR_ASSUME_YES.

ssr-status surfaces the snapshotted-domain count.
README documents the snapshot flow, default domain table, conflict UX,
and the five new config keys.

Co-authored-by: Cursor <cursoragent@cursor.com>

bin/ssr-sync

@@ -13,6 +13,8 @@ source "$SSR_ROOT/lib/brew.sh"
 source "$SSR_ROOT/lib/mackup.sh"
 # shellcheck source=../lib/apps.sh
 source "$SSR_ROOT/lib/apps.sh"
+# shellcheck source=../lib/macos-prefs.sh
+source "$SSR_ROOT/lib/macos-prefs.sh"
 
 ssr::require_macos
 ssr::load_config
@@ -54,6 +56,12 @@ if [[ "${SSR_SCAN_UNMANAGED_APPS:-true}" == "true" ]]; then
     fi
 fi
 
+# Snapshot macOS preference domains so they can be restored on a new machine.
+if [[ "${SSR_SNAPSHOT_MACOS_PREFS:-true}" == "true" ]]; then
+    ssr::log "Snapshotting macOS preferences"
+    ssr::macos::prefs_export "$backup_dir"
+fi
+
 # Record sync time so `ssr status` can report freshness.
 state_dir="${SSR_STATE_DIR:-$HOME/.local/state/ssr}"
 ssr::ensure_dir "$state_dir"